Ryuk Ransomware Operator Sentenced: Detection and Hardening Guide for Ryuk-Style Encryption Attacks

---
title: Shadow Copy Deletion via Vssadmin Wmic or Bcdedit
id: 1c8f2a4e-7b3d-4e9f-a2c1-9d5e6f7a8b9c
status: experimental
description: Detects deletion of volume shadow copies or disabling of recovery options, a hallmark ransomware anti-recovery behavior used by Ryuk and successor families.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.bleepingcomputer.com/news/security/ryuk-ransomware-member-sentenced-to-24-months-in-prison/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: 1 of selection_*
falsepositives:
  - Rare; some backup agents resize shadowstorage — whitelist by process lineage
level: high
---
title: PsExec Service Binary Dropped to ADMIN Share
id: 2d9a3b5f-8c4e-5f1a-b3d2-0e6f7a8b9c0d
status: experimental
description: Detects file creation of PsExec-style service binaries in the ADMIN$ share, a primary lateral movement mechanism used by Ryuk operators to push encryptors across the domain.
references:
  - https://attack.mitre.org/techniques/T1569/002/
  - https://www.bleepingcomputer.com/news/security/ryuk-ransomware-member-sentenced-to-24-months-in-prison/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains: '\ADMIN$\'
    TargetFilename|endswith: '.exe'
  filter_legit:
    TargetFilename|contains:
      - '\SCCM\'
      - '\PatchMyPC\'
      - '\ManageEngine\'
  condition: selection_path and not filter_legit
falsepositives:
  - Legitimate remote administration and deployment tools — maintain a strict whitelist of known service binary names and hashes
level: high
---
title: Ransom Note File Creation Across Multiple Directories
id: 3e0b4c6a-9d5f-6a2b-c4e3-1f7a8b9c0d1e
status: experimental
description: Detects creation of known ransomware note filenames associated with Ryuk-style encryption campaigns.
references:
  - https://attack.mitre.org/techniques/T1486/
  - https://www.bleepingcomputer.com/news/security/ryuk-ransomware-member-sentenced-to-24-months-in-prison/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\RyukReadMe.txt'
      - '\RyukReadMe.html'
      - '\UNIQUE_ID_DO_NOT_REMOVE.txt'
falsepositives:
  - Unlikely outside of adversary emulation or IR tooling
level: critical

// Hunt: Shadow copy deletion + PsExec lateral movement + ransom note artifacts
// Sentinel/Defender XDR — 7-day lookback
let lookback = 7d;
union isfuzzy=true
(DeviceProcessEvents
 | where TimeGenerated >= ago(lookback)
 | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete shadows", "resize shadowstorage"))
      or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy delete")
      or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
 | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Indicator = "ShadowCopyDeletion"),
(DeviceEvents
 | where TimeGenerated >= ago(lookback)
 | where ActionType == "ServiceInstalled"
 | where AdditionalFields has "PSEXESVC" or (AdditionalFields has "ADMIN$" and AdditionalFields has ".exe")
 | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, Indicator = "PsExecStyleServiceInstall"),
(DeviceFileEvents
 | where TimeGenerated >= ago(lookback)
 | where FileName has_any ("RyukReadMe.txt", "RyukReadMe.html", "ReadMe.txt")
 | where ActionType == "FileCreated"
 | summarize NoteCount = count(), Directories = make_set(FolderPath, 25) by DeviceName, FileName, bin(TimeGenerated, 1h)
 | where NoteCount > 5
 | project TimeGenerated, DeviceName, FileName, NoteCount, Indicator = "MassRansomNoteCreation")
| sort by TimeGenerated desc

-- Hunt: Anti-recovery process execution and suspicious service binaries
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures)'
   OR Exe =~ '(?i)\\\\Windows\\\\PSEXESVC'
   OR Name =~ '(?i)^(PSEXESVC|[A-Za-z0-9]{8,16})\.exe$'

# Ryuk-style ransomware readiness audit — run as Administrator
# 1. Verify Volume Shadow Copies exist and are enabled
Write-Host "=== Shadow Copy Status ===" -ForegroundColor Cyan
Get-CimInstance Win32_ShadowCopy | Select-Object VolumeName, InstallDate | Format-Table -AutoSize
vssadmin list shadows 2>$null | Select-String -Pattern "Shadow Copy Volume"

# 2. Check recoveryenabled flag (should NOT be 'No' on production systems)
Write-Host "`n=== Boot Recovery Config ===" -ForegroundColor Cyan
bcdedit /enum {current} | Select-String -Pattern "recoveryenabled"

# 3. Audit for PsExec-style services
Write-Host "`n=== Suspicious Services ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match '^PSEXESVC' -or
    ($_.PathName -match 'ADMIN\$' -and $_.PathName -match '\.exe')
} | Select-Object Name, State, PathName, StartName | Format-List

# 4. Confirm RDP is not exposed and NLA is enforced
Write-Host "`n=== RDP Hardening ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication
Write-Host ("RDP Enabled: {0} | NLA Required: {1}" -f ($rdp.fDenyTSConnections -eq 0), ($nla.UserAuthentication -eq 1))

# 5. Verify SMB signing and SMBv1 disabled (legacy wormable paths)
Write-Host "`n=== SMB Hardening ===" -ForegroundColor Cyan
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, RequireSecuritySignature | Format-Table -AutoSize

Write-Host "`nReview complete. Any shadow copy gaps, PsExec services, or NLA=0 findings require immediate follow-up." -ForegroundColor Yellow